Compare commits
2 Commits
cc37122276
...
28edc9e99f
| Author | SHA256 | Date | |
|---|---|---|---|
|
28edc9e99f
|
|||
|
5ba1fa34ff
|
@@ -32,6 +32,10 @@
|
||||
<organization>Centurion Intelligence Consulting Agency
|
||||
</organization>
|
||||
<address>
|
||||
<postal>
|
||||
<city>Lisboa</city>
|
||||
<country>PT</country>
|
||||
</postal>
|
||||
<phone>+1 (202) 992 1702</phone>
|
||||
<email>rfc.editor@coresecret.eu</email>
|
||||
<uri>https://coresecret.eu/</uri>
|
||||
@@ -137,8 +141,8 @@
|
||||
<section>
|
||||
<name>CATALOG approach</name>
|
||||
<t>Currently, there is no standardized, discoverable mechanism in DNS for a domain owner to declare, which
|
||||
Certificate Transparency (CT) Logs must or may record its Certificates.
|
||||
As a result, CAs rely on out-of-band configurations or hard-coded lists,
|
||||
Certificate Transparency (CT) Logs must or may record its Certificates. As a result, CAs rely on
|
||||
out-of-band configurations or hard-coded lists,
|
||||
increasing operational complexity and expanding the attack surface.
|
||||
</t>
|
||||
<section>
|
||||
@@ -1247,10 +1251,10 @@ https://caa-ct-sts.<domain>.<tld>/.well-known/caa-ct-sts.txt
|
||||
</t>
|
||||
</section>
|
||||
<section anchor="redundancy">
|
||||
<name>Policy Redundancy Considerations |𝑪| ≥ 𝑛 + 1 ∧ |𝑾| ≤ 2</name>
|
||||
<t>Let 𝐶 be the number of critical CT-Logs and 𝑊 be the number of whitelisted (non-critical) CT-Logs,
|
||||
<name>Policy Redundancy Considerations</name>
|
||||
<t>Let c be the number of critical CT-Logs and w be the number of whitelisted (non-critical) CT-Logs,
|
||||
then the following expression is strongly <strong>RECOMMENDED</strong>:
|
||||
|𝑪| ≥ 𝑛 + 1 ∧ |𝑾| ≤ 2
|
||||
|c| ≥ n + 1 ∧ |w| ≤ 2
|
||||
</t>
|
||||
<t>While the "critical=true" flag in the CAA <strong>"issuect"</strong> Parameter enforces that every
|
||||
Certificate issuance must be logged to all specified CT-Logs, this strict requirement can introduce
|
||||
@@ -2061,7 +2065,7 @@ echo "${JSON}" | awk -v OWN="${OWN_DOMAIN}" -v CA="${CAA_DOMAIN}" -v CRIT="${CRI
|
||||
improved the technical clarity and robustness of this draft. Their objective and insightful feedback has been
|
||||
invaluable in refining the specification.
|
||||
</t>
|
||||
<contact fullname="André Horst Zimnol" initials="A. H."
|
||||
<contact fullname="Andre Horst Zimnol" initials="A. H."
|
||||
surname="Zimnol">
|
||||
<organization>Private Contributor</organization>
|
||||
<address>
|
||||
|
||||
Reference in New Issue
Block a user